|
1. What is Encryption?
2. Why Does the United States Control Encryption Exports?
3. Are Imports of Encryption Controlled?
4. Is the Use of Encryption within the United
States Controlled?
5. Can I Send an Encrypted Message to Someone
Outside the United States?
6. Where Can I Obtain a License to Export?
7. What Constitutes an "Export"?
8. Can You Distribute Encryption Software via the
Internet?
9. Can’t I Simply Place My Encryption Software in the Public
Domain, and Avoid Export Controls?
10.Do I
Need a License to Take My Laptop Computer with Encryption Software on
My Next Business Trip Outside the United States?
What
is Encryption? Encryption is a method of
making information secret, so that only a person who knows the method
can understand or decrypt the information. For a thorough review of
encryption methods, see Bruce Schneier’s web
page,
the author of Applied Cryptography.
Back
to Top
Why
Does the United States Control Encryption Exports? The U.S. Government uses
encryption to secure military, diplomatic and intelligence information,
and wishes to deny others the ability to secure their information using
American products, except under license. In addition, law enforcement
(the Department of Justice’s Federal Bureau of Investigation) is
concerned that the widespread use of encryption will make it more difficult
to conduct electronic surveillance in the future.
Back
to Top
Are
Imports of Encryption Controlled? No. The United States does not
control the importation of encryption at this time. However, FBI documents obtained by the Electronic Privacy Information
Center under the
Freedom of Information Act state that "Technical solutions, such
as they are, will only work if they are incorporated into all
encryption products. To ensure that this occurs, legislation mandating
the use of Government approved encryption products or adherence to
Government encryption criteria is required."
Back
to Top
Is
the Use of Encryption within the United States Controlled? No. However, the U.S.
government is trying to influence the market toward deployment of
products which provide government access, through imposition of export
controls and development of a Federal Information Processing Standard
for government procurement. Link to The Technical Advisory
Committee to Develop a Federal Information Processing Standard for the
Federal Key Management Infrastructure.
Back
to Top
Can
I Send an Encrypted Message to Someone Outside the United States? U.S. law does not restrict
the transmission of information, merely because it has been encrypted.
However, the information itself may require a license, under U.S.
export control laws and regulations. For example, you may encrypt and
export the Bible to anyone (even Castro), but you may not encrypt and
export classified information related to nuclear weapons to anyone
(even a Canadian) without a license.
Back
to Top
Where
Can I Obtain a License to Export? The Department of Commerce’s Bureau of Industry
and Security accepts applications for licenses to export encryption products
and technologies. The Departments of Defense, Justice and State also
have the right to review license applications.
Back
to Top
What
Constitutes an "Export"? Physical or electronic transfer of
encryption hardware, software or information outside the United States
constitutes an export. So does release within the United States
to an embassy of a foreign government.
Back
to Top
Can
You Distribute Encryption Software via the Internet? You may distribute encryption
software via the Internet, provided that you take "adequate
precautions" to ensure that the software is not exported contrary
to U.S.
law. Such precautions include (1) a warning to the person wishing to
download the software that it is subject to U.S. export controls, (2) a
commitment on the part of the person that the software will not be
exported contrary to U.S. law, and (3) a procedure for verifying that
the host computer is located within the United States.
Back
to Top
Can’t
I Simply Place My Encryption Software in the Public Domain, and
Avoid Export Controls? The U.S. Government threatened to indict Philip
Zimmermann on criminal charges when his encryption program, Pretty Good Privacy, was posted on the Internet
without precautions. Daniel Bernstein, Philip Karn
and Peter Junger are challenging the
constitutionality of export controls on encryption software.
For more
information on these three legal cases, follow these links: Bernstein
v. U.S. Dept of State, Karn v. U.S. Dept. of
State, and Junger v. U.S. Dept. of State.
Back
to Top
Do
I Need a License to Take My Laptop Computer with Encryption Software
on My Next Business Trip Outside the United States? Probably not. Most temporary
exports by business travelers qualify for either License Exception TMP
or License Exception BAG of the Export Administration Regulations.
However, you may wish to review the requirements for the use of these
License Exceptions. Also, the following excerpt of an unpublished
letter on Temporary Exports of Encryption Software from Larry
Christensen, Director of the Regulatory Policy Division provide some
more information:
"The tools of
trade authority at §740.9(a)(2)(i) of the EAR authorizes the temporary export of
tools of the trade for any lawful purpose in usual and reasonable
quantities by employees of the exporter. However, for Country Group D:1, this authority is limited to equipment necessary
to commission or service goods. In today's international environment,
we believe encryption software is necessary to service a lawfully
exported laptop computer. Such software may be exported when contained
in a laptop computer that itself is lawfully exported and so long as
all the other conditions of §740.9(a)(2)(i)
are met. Please note that the tools of the trade authority under
License Exception TMP is not available for exports to Country Group E:1, Supplement No.1 to Part 740 of the EAR. As you
know, the tools of trade authority under License Exception BAG
authorizes the export of encryption software when owned by the
individual and when the terms of §740.14(b)(4)
of the EAR are met."
Back
to Top
|
